Misplaced Pages

Heartbleed

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.

This is an old revision of this page, as edited by Enquire (talk | contribs) at 16:55, 9 April 2014 (create section for major government website affected). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Revision as of 16:55, 9 April 2014 by Enquire (talk | contribs) (create section for major government website affected)(diff) ← Previous revision | Latest revision (diff) | Newer revision → (diff)
This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)
This article may require cleanup to meet Misplaced Pages's quality standards. The specific problem is: verification, wikifying, links to other pages (currently orphan). Please help improve this article if you can. (April 2014) (Learn how and when to remove this message)
This article has no links to other Misplaced Pages articles. Please help improve this article by adding links that are relevant to the context within the existing text. (April 2014)
This article is an orphan, as no other articles link to it. Please introduce links to this page from related articles; try the Find link tool for suggestions. (April 2014)
This article contains promotional content. Please help improve it by removing promotional language and inappropriate external links, and by adding encyclopedic text written from a neutral point of view. (April 2014) (Learn how and when to remove this message)
(Learn how and when to remove this message)

The Internet and the Heartbleed Bug. For certain security reasons, about 66 percent of the internet including the worldwide web, and its constituent websites use security features to protect data access and transfer between servers, individual users, or either between the former and the latter. The Heartbleed Bug has proven to be "lethal" and so measures are being employed to counter the "infection".

It is called heart bleed because: Bug is in the OpenSSL's implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). When it is exploited it leads to the leak of memory contents from the server to the client and from the client to the server, as reported on the www.heartbleed.com

Several websites, including many well known ones have been affected but quite a few famous ones such as craigslist.org, Facebook.com and Google, among others are protected and not vulnerable to this bug. This internet security problem is a bug: yet, not a design flaw and it occurs in the implementation of the OpenSSL.

It was reported as early as on the 7th April, 2014.

As reported by heartbleed.com:

This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon and Neel Mehta of Google Security, who first reported it to the OpenSSL team. Codenomicon team found heartbleed bug while improving the SafeGuard feature in Codenomicon's Defensics security testing tools and reported this bug to the NCSC-FI for vulnerability coordination and reporting to OpenSSL team.

The security experts say the Internet will remain vulnerable as long as the flawed version of OpenSSL is in use. Although Fixed OpenSSL has been released, it must be deployed, according to beforeitsnews.com

Digg.com writes that, "The Heartbleed bug is a just-discovered vulnerability in the immensely popular OpenSSL cryptographic software library. OpenSSL is the most widely used implementation of a suite of security protocols called Secure Sockets Layer (SSL) that help encrypt traffic while surfing the web."

Government site affected

Canada

The Canadian Revenue Agency (CRA) closed-down its electronic services website over Heartbleed bug security concerns.

References

  1. Petri, Josh (8 April 2014). "Explaining The Terrifying Bug That Just Exposed A Huge Portion Of The Internet's Secrets". Digg.com. Retrieved 9 April 2014.{{cite web}}: CS1 maint: year (link)
  2. "Security concerns prompts tax agency to shut down website". CTV News. 2014-04-09. Retrieved 2014-04-09.
  3. "How widespread is this?", www.heartbleed.com. April 08, 2014. Web
  4. "Why it is called the Heartbleed Bug?", www.heartbleed.com. April 08, 2014. Web
  5. "What versions of the OpenSSL are affected?", www.heartbleed.com. April 08, 2014. Web
  6. "The security experts...", www.beforeitsnews .com. April 08, 2014. Web


This article has not been added to any content categories. Please help out by adding categories to it so that it can be listed with similar articles. (April 2014)
This article needs additional or more specific categories. Please help out by adding categories to it so that it can be listed with similar articles. (April 2014)
Categories: